CN108183868A - It is handled using the Dynamic network device of external component - Google Patents

Abstract

Embodiments of the present disclosure relate to dynamic network device processing using external components. The network device may receive information about a service set identifying services to apply to data streams received via a specific interface of the network device; receive the data stream via the specific interface; identify services to provide to the data stream based on the information about the service set; A processing device is identified to process the data stream; and the data stream is provided to the processing device. A processing device may be distinct from a network device and may process a data stream on behalf of a network device to form a processed data stream. The processed data streams may include data streams with services applied to the data streams. The network device may further receive the processed data stream from the processing device and send the processed data stream towards the destination device.

Description

Dynamic network device handling using external components

Related Application Citations

This application is a divisional application of an invention patent application with the application number 201310751351.1, the application date is December 31, 2013, the priority date is December 31, 2012, and the invention title is "Dynamic Network Device Processing Using External Components" .

technical field

The present invention relates to network devices, and more particularly to network devices, methods and systems for dynamic network device processing using external components.

Background technique

Network devices, such as routers, are sometimes used to process, route, and provide services to data flows between user devices and server devices. Network devices sometimes include wide area network (WAN) interface cards (WICs). A WIC may include processing instructions, routing tables, or some other information that provides instructions to network devices for processing data flows. Modifying the functionality and/or operation of network devices (eg, modifying processing instructions, etc.) may require replacement of WAN cards and/or specialized software development.

Contents of the invention

According to an exemplary embodiment, a method may include receiving, by a network device, information about a set of services. A service set may identify services to apply to data streams received via a particular interface of a network device. The method may further include receiving, by the network device, the data stream by the specific interface; identifying, by the network device, a service to apply to the data stream based on the information about the set of services, and identifying, by the network device, a processing device to process the data stream. Processing equipment can be different from network equipment. The method may further include providing the data stream to the processing device through the network device. The processing device may process the data stream on behalf of the network device to form a processed data stream. The processed data streams may include data streams with services applied to the data streams. The method may further include receiving the processed data stream from the processing device through the network device, and sending the processed data stream to the target device through the network device.

According to another example embodiment, a network device may receive information about a set of services. A service set may include an identifier to identify a service to apply to a data flow received via a particular interface of a network device. The network device may further receive the data stream via the particular interface, identify services to apply to the received data stream based on the information about the set of services, add metadata, possibly including an identifier, to the data stream, and identify a processing device to process the data stream. Processing equipment can be different from network equipment. The network device may further provide the data stream to the processing device. The processing device may identify the service based on the identifier included in the metadata and process the data stream on behalf of the network device to form a processed data stream. The processed data streams may include data streams with services applied to the data streams. The network device may further receive the processed data stream from the processing device and send the processed data stream to the destination device.

According to another exemplary embodiment, a computer-readable medium for storing instructions may include instructions having a plurality of instructions that, when executed by one or more processors associated with a network device, result in one or more a processor receives information about a service set identifying services to apply to a data flow received via a particular interface of the network device, receives the data flow via the particular interface, identifies a service to provide to the data flow based on the information about the service set, and A virtual machine among multiple virtual machines is identified to process data flow. A virtual machine can be different from a network device. The plurality of instructions may further cause one or more processors to provide data streams to the virtual machine. The virtual machine can identify the service based on the service set identifier and can process the data flow on behalf of the network device to form a processed data flow. The processed data streams may include data streams with services applied to the data streams. The plurality of instructions may further cause the one or more processors to receive the processed data stream from the virtual machine; and provide the processed data stream to the target device.

Description of drawings

Figure 1 illustrates an example overview of the embodiments described herein;

FIG. 2 illustrates an example environment in which the systems and/or methods described herein may be implemented;

FIG. 3A illustrates example components of a network device;

FIG. 3B illustrates example components that may be used with the device within the environment of FIG. 2;

FIG. 4 illustrates an example data structure that may be stored by one or more devices in the environment of FIG. 2;

5 illustrates a flow diagram of an example process for processing a data stream using a virtual machine; and

6A-6B and 7-8 illustrate example embodiments as described herein.

Detailed ways

The following detailed description refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements.

The systems and/or methods described herein may allow processes, applications, and/or services of a network device (eg, a router, switch, gateway, or some other network device) to occur outside of the network device. For example, the virtual machine can execute an application that modifies the control plane of the network device (eg, modifies the routing table of the network device, installs firewall filtering on the network device, etc.). Additionally, or alternatively, a virtual machine may process data streams on behalf of a network device to allow the network device to provide services to the data stream (e.g., firewall services, network address translation (NAT) services, wide area network (WAN) optimization services, hypertext transfer protocol (HTTP header rewriting service, compression service, load balancing service, or some other type of service). In some implementations, the client device may provide a set of services or applications to the virtual machine and the network device to instruct the virtual machine to modify the control plane of the network device. In some implementations, the service set can instruct the network device to provide a specific service for a specific data flow, and direct the specific data flow to a specific virtual machine, so that the specific data flow can receive the service. In some implementations, a service set can instruct a virtual machine to apply a specific service to a specific data stream. As a result, the functionality and/or operation of a network device can be modified without requiring modification of the network device itself.

Figure 1 illustrates an example embodiment described herein. As shown in FIG. 1 , the network device may receive a first data stream (eg, data stream 1 ) from a first user device (eg, UD-1) via a first interface of the network device. To receive processing support to allow the network device to service the first data flow, the network device may identify a particular virtual machine (eg, VM-1 ) with which to communicate (eg, based on an interface). As further shown in FIG. 1 , the network device can route the data flow to the virtual machine. A virtual machine may process a data flow on behalf of a network device to form a processed data flow (eg, a data flow with a service applied to the data flow). In some implementations, the network device may provide the processed data stream to the target device. In some embodiments, in order to provide services for multiple data streams (eg, data stream 1 to data stream M), the network device may receive multiple data streams (eg, data streams 1 to M, where M≥2), and Communicate with multiple virtual machines (eg, VM-1 to VM-N, where N > 2).

In some implementations, the network device may identify services to provide to the data flow (and the virtual machines with which it communicates to process the data flow to provide the service) based on the information associated with the service set. The set of services may include information identifying an interface of a network device, services provided to data flows received through the interfaces, and virtual machines with which to communicate for processing and providing services to the data flows.

As noted above, virtual machines can execute applications to modify the control plane of a network device. For example, a virtual machine can modify the control plane of a network device to instruct the network device to route certain data flows in a specific manner (eg, route some data flows to specific virtual machines for processing, block some other data flows, etc.).

Since a virtual machine may be used to process data flows on behalf of a network device, or to modify the control plane of a network device, a network device may be able to provide any number of services to any number of data flows by communicating with a virtual machine over a utility. Further, virtual machines can be stored by servers located in various geographical locations.

Although the systems and/or methods are described in terms of a network device communicating with a virtual machine, in practice, a network device may communicate with a physical server, a WAN card, a container (e.g., a Linux container), or for processor support and/or Communication with some other devices for control plane modification of network devices.

FIG. 2 is a diagram of an example environment 200 in which the systems and/or methods described herein may be implemented. As shown in FIG. 2 , environment 200 may include user devices 210-1...210-A (where A≥1), client devices 220, network devices 230, virtual machine server(s) 240, central server 250, and network 260 .

User equipment 210 may include devices capable of communicating over a network, such as network 260 . For example, user device 210 may correspond to a mobile communication device (e.g., a smartphone or a personal digital assistant (PDA)), a portable computing device (e.g., a laptop or tablet computer), a gaming device, a desktop computer, a server, or some other type of computing device.

Client device 220 may include a computing device or collection of computing devices. In some implementations, client device 220 may be used to develop a set of services that direct network device 230 to communicate with virtual machines stored by virtual machine server 240 (e.g., for processing support to allow network device 230 to stream data Provide services). Additionally, or alternatively, client device 220 may be used to develop applications that virtual machine server 240 may execute to modify the control plane of network device 230 . In some implementations, client device 220 may provide a set of services or applications to network device 230 or central server 250 .

Network device 230 may include a network routing device or a collection of network routing devices. In some implementations, network device 230 may include a router, switch, gateway, access point, or some other type of network device. In some implementations, network device 230 may receive the data stream and may process the data stream according to parameters specified in the service set. In some implementations, network device 230 may include a physical routing device or a virtual routing device (eg, a virtual image stored by a server that is a physical routing device).

Virtual machine server 240 may include a computing device, such as a server device or collection of server devices. In some implementations, the virtual machine server 240 can implement a virtual machine, and the virtual machine can provide processing support to the network device 230 by providing services to the data stream as a processing device (for example, allowing the network device 230 to provide processing support for the data stream according to a service set). Serve). Additionally, or alternatively, virtual machine server 240 may implement a virtual machine that may execute applications to modify the control plane of network device 230 . In some implementations, environment 200 may include a plurality of virtual machine servers 240, which may be provided as part of a data center. For example, the data center can connect multiple virtual machine servers 240, so that the services provided by the multiple virtual machine servers 240 can be combined together, and so that the services provided by the multiple virtual machine servers 240 can be provided by the network device 230 read easily. In some implementations, each virtual machine server 240 may implement multiple virtual machines from which network device 230 may select to serve data streams.

In some implementations, virtual machine server 240 can provide active and/or passive services to data streams. For example, in active service, virtual machine server 240 may modify, drop or insert packets in the data stream. For example, in a passive service, the virtual machine server 240 may monitor the data flow and may not forward the data flow. In some implementations, passive services may operate on backups or samples of data streams.

In some implementations, specific virtual machines implemented by virtual machine server 240 may exit specific services for specific sessions or specific portions of sessions. For example, assume that virtual machine server 240 provides HTTP services to HTTP messages, and virtual machine server 240 provides services to HTTP messages based on headers of the HTTP messages. Assume further that the header of the HTTP message is received by virtual machine server 240 via the first part of the session, and the body of the HTTP message is received by virtual machine server 240 via the second part of the session. Given these assumptions, since virtual machine server 240 can serve HTTP messages based on the headers of the HTTP message, and the body of the HTTP message may not be required, virtual machine server 240 can exit service HTTP for the second part of the session. In some implementations, service opt-out may result in improved performance by reducing the number of sessions or portions of sessions in which the service is provided.

In some implementations, virtual machine server 240 may identify additional services to apply to different data streams on a per stream basis. For example, virtual machine server 240 may perform a deep packet inspection service on the data flow, may identify the type of session associated with the data flow (e.g., a video type session), and may identify additional services to apply to the data flow based on the type of session . For example, for a video type session, virtual machine server 240 may provide caching services, while for another type of session in another stream, virtual machine server 240 may provide some other service (e.g., an intrusion detection service or some other service ). As a result, different data streams may be directed to different virtual machines implemented by virtual machine server 240 .

Central server 250 may include a computing device, such as a server device or collection of server devices. In some implementations, the central server 250 may store the set of services and/or applications provided by the client devices 220 . Central server 250 may provision network device 230 to direct network device 230 to provide services to data flows (eg, based on information associated with service sets). Alternatively, network device 230 may receive a set of services from central server 250 or client device 220 and may identify services to provide to the data stream based on the set of services. In some implementations, the central server 250 can generate the virtual machines implemented by the virtual machine server(s) 240 based on the information in the service set. Central server 250 may also act as a directory server to broadcast information about virtual machines that network device 230 may discover.

Network 260 may include one or more wired and/or wireless networks. For example, network 260 may include a cellular network, a public land mobile network (PLMN), a second generation (2G) network, a third generation (3G) network, a fourth generation (4G) network, a fifth generation (5G) network, and/or other networks. Additionally, or alternatively, network 260 may include a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), an ad hoc network, a managed IP network , a virtual private network (VPN), an intranet, the Internet, and/or combinations of these or other types of networks.

The number of devices and/or networks illustrated in FIG. 2 is not limited to that shown. In fact, there may be additional devices and/or networks; fewer devices and/or networks; different devices and/or networks; or differently arranged devices and/or networks than that illustrated in FIG. 2 . Also, in some implementations, one or more devices of environment 200 may perform one or more functions described as being performed by another device or devices of environment 200 . The devices of environment 200 may be interconnected via wired connections, wireless connections, or a combination of wired and wireless connections.

FIG. 3A illustrates example components of network device 230 . As shown in FIG. 3A , the network device 230 may include a routing component 301 , an input/output (I/O) component 302 and a switch 303 .

Routing component 301 may include a routing processor or a collection of routing processors. In some implementations, the routing component 301 can perform advanced management functions for the network device 230 . For example, routing component 301 can communicate with networks and/or systems connected to network device 230 to exchange information about the topology of the network. In some implementation manners, the routing component 301 can generate a routing table based on the network topology information, can generate a forwarding table based on the routing table, and can send the forwarding table to the I/O component 302 . In some implementations, routing component 301 may perform other general control and monitoring functions for network device 230 .

I/O component 302 may include an interface device or collection of interface devices. In some implementations, I/O component 302 may be connected to routing component 301 and switch 303 . In some implementations, I/O component 302 can receive packets over physical links connected to a network. Each physical link can be one of many types of transmission media, such as fiber optics or Ethernet cables. Packets on the physical link may be formatted according to one of several protocols, such as the Synchronous Optical Network (SONET) standard or Ethernet. In some implementations, I/O component 302 can use forwarding tables to perform routing lookups for incoming data flows.

Switch 303 may include one or more switching planes to facilitate communication between two or more I/O components 302 . In some implementations, switch 303 may include a single or multi-stage switch fabric.

FIG. 3B illustrates example components of device 300 that may be used within environment 200 of FIG. 2 . Device 300 may correspond to user device 210 , client device 220 , virtual machine server 240 or central server 250 . Each of user device 210 , client device 220 , virtual machine server 240 , or central server 250 may include one or more devices 300 and/or one or more components of devices 300 .

As shown in FIG. 3B , device 300 may include bus 305 , processor 310 , main memory 315 , read only memory (ROM) 320 , storage device 325 , input device 330 , output device 335 , and communication interface 340 . In some implementations, device 300 may include additional components, fewer components, different components, or differently arranged components.

Bus 305 may include paths that allow communication between components of device 300 . Processor 310 may include a processor, microprocessor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), or other type of processor that interprets and executes instructions. Main memory 315 may include random access memory (RAM) or other types of dynamic storage devices that store information or instructions for execution by processor 310 . ROM 320 may include a ROM device or other type of static storage device that stores information or instructions for use by processor 310 . Storage device 325 may include magnetic storage media such as a hard drive or removable memory such as flash memory.

Input device 330 may include components that allow an operator to enter information into device 300, such as control buttons, a keyboard, keys, or other types of input devices. Output devices 335 may include components that output information to an operator, such as light emitting diodes (LEDs), displays, or other types of output devices. Communication interface 340 may include any transceiver-like mechanism that enables device 300 to communicate with other devices or networks. In one embodiment, the communication interface 340 may include a wireless interface, a wired interface, or a combination of a wireless interface and a wired interface.

Device 300 may perform certain operations as described in detail below. Device 300 may perform these operations in response to processor 310 executing software instructions contained in a computer-readable medium, such as main memory 315 . A computer readable medium may be defined as a persistent storage device. A memory device may include memory space within a single physical storage device or memory space spread across multiple physical storage devices.

Software instructions may be read into main memory 315 from another computer-readable medium, such as storage device 325 or from another device through communication interface 340 . The software instructions contained in the main memory 315 can direct the processor 310 to perform the processes that will be described later. Alternatively, hard-wired circuitry may be used in place of or in combination with software instructions to implement the processes described herein. Thus, implementations described herein are not limited to any specific combination of hardware circuitry and software.

FIG. 4 illustrates an example data structure 400 that may be stored by one or more devices in environment 200 , such as client device 220 , network device 230 , virtual machine server 240 , or central server 250 . In one embodiment, data structure 400 may be stored in memory of client device 220 , network device 230 , virtual machine server 240 , or central server 250 . In another embodiment, data structure 400 may be stored in memory separate from, but accessible by, client device 220 , network device 230 , virtual machine server 240 , or central server 250 . In some implementations, a portion of data structure 400 may be stored by a device in environment 200 and another portion of data structure 400 may be stored by another device in environment 200 .

As shown in FIG. 4 , the data structure 400 may include an interface information field 410 , a service set ID field 420 , a service parameter field 430 and a virtual machine information field 440 .

Interface information field 410 may identify information associated with an interface of network device 230 . For example, interface information field 410 may identify an interface identifier (ID), filter, and direction of data flow (eg, inbound or outbound direction). In some implementations, the interface ID field may store a string of characters to identify an interface of network device 230 (eg, an Ethernet interface, a frame relay interface, a serial interface, a SONET interface, or some other type of interface). Additionally, or alternatively, the interface ID may correspond to a port identifier or some other identifier that identifies an interface of network device 230 through which network device 230 may receive a data stream.

In some implementations, a particular interface may be associated with a particular group of user devices 210 (eg, a group of user devices 210 subscribed to a service with a network equipment provider). That is, the network device 230 may receive a data stream from a user device 210 that is part of the first group of user devices 210 via the first interface. Similarly, the network device 230 may receive a data stream via the second interface from another user device 210 that is part of the second group of user devices 210 . As described above, a set of services may identify services to provide to a data flow based on data received via a particular interface of the network device 230 . Thus, the network device 230 may provide a first service for data streams received from the first group of user devices 210 and a second service for data streams received from the second group of user devices 210 .

In some implementations, network device 230 may determine a service to provide to a data stream that is received via a particular interface and that satisfies a particular filter. The network device 230 may also determine specific service parameters to provide to the data flow (eg, specific rules for firewall services, specific address pools for NAT services). Further, network device 230 may determine a set of services to provide to a data flow based on the direction of the data flow (eg, inbound or outbound direction). An inbound or outbound field may store information identifying the direction of data flow associated with a particular set of services. For example, network device 230 may identify a service to provide to a data flow based on whether the data flow is an inbound data flow or an outbound data flow. In some implementations, the inbound direction may relate to data streams received by network device 230 . The outbound direction may relate to data streams sent by network device 230 .

A filter domain may identify filter criteria (eg, as identified by an interface ID) for data streams received by a particular interface. In some implementations, network device 230 may use filters to select particular data flows by examining the contents of packets associated with the data flows. In some implementations, the filter may direct the network device 230 to select a data flow based on information stored in the filter field. For example, a filtering domain may identify an Internet Protocol (IP) address, a hardware ID, a user ID, or some other identifier associated with the data flow.

As an example, assume that the filtering domain stores two IP addresses, such as "172.25.14.4" and "174.23.6.52". Further, assume that the network device 230 receives two data streams via the interface corresponding to the interface ID "4896". Further, assume that the two data flows received by the network device 230 are respectively associated with IP addresses "172.25.14.4" and "555.23.6.52". Network device 230 may serve data flows associated with IP address "172.25.14.4," and may not service data flows associated with IP address "555.23.6.52." In some implementations, the filtering domain may store a whitelist (e.g., a list of IP addresses, or some other identifier associated with a data flow to identify data flows to which network device 230 may provide service) or a blacklist (e.g., , a list of IP addresses, or some other identifier associated with a data flow to identify a data flow to which network device 230 may not provide service).

In some implementations, filters can be stateless. For example, a filter may direct network device 230 to select a data flow based on the individual packets associated with the data flow. Alternatively, filters can be stateful. For example, a filter may direct network device 230 to select a data flow based on previously received packets.

The service set ID field 420 may store a string of characters to uniquely identify the service set associated with a specific interface, a specific filter, and a specific data flow direction. As shown in FIG. 4 , a service set with service set ID 123 may be associated with data flows received via interface ID 5844 in the inbound direction. Accordingly, network device 230 may recognize service set ID 123 when processing data flows received via interface ID 5844 in the inbound direction. In some implementations, a service set ID may be generated when a new service set is received by the network device 230 or the central server 250 . In some implementations (eg, when the service set ID is a number), the generated service set ID may be the next number after the most recently used service set ID.

As another example, assume that a service set with service set ID 584 is associated with a data flow received via interface ID 4896 in either the inbound or outbound direction. Further, assume that a filter (eg, a whitelist or blacklist of IP addresses) is associated with a service set ID 584 . Accordingly, network device 230 may identify service set ID 584 when processing data flow received via interface ID 4896 in either the inbound or outbound direction and satisfies the filter.

Service parameters field 430 may store information identifying a set of rules, instructions, procedures, functions, or some other information associated with a particular set of services. In some implementations, the information stored by the service parameter field 430 may correspond to a service provided to the data flow. For example, as shown in FIG. 4 , service parameter field 430 may store information directing network device 230 to provide firewall services to data flows associated with service set ID 123 (e.g., traffic received via interface ID 5844 in the inbound direction data flow). Additionally, the service parameter field 430 may store specific parameters associated with the service, such as a specific routing operation, a list of IP addresses, a list of NAT rules, or some other parameter associated with the service. In some implementations, the service parameter field 430 may store multiple service parameters for a single set of services.

Virtual machine information field 440 may store information to identify the particular virtual machine with which network device 230 communicates to provide services to the data stream. For example, the virtual machine information field 440 may store a virtual machine ID (VM ID), a server ID (e.g., an identifier associated with a particular virtual machine server 240), the virtual machine and/or the IP address of the virtual machine server 240, and /or some other information identifying the virtual machine. In some implementations, the virtual machine information domain 440 may not store information specific to a virtual machine, and may store information such as "auto-select" to instruct the network device 230 to perform an auto-select function to identify an available virtual machine to communicate with.

Although certain fields are shown in a particular form in data structure 400, in practice, data structure 400 may include additional fields, fewer fields, different fields, or be differently named than those shown in FIG. configured domain.

5 illustrates a flow diagram of an example process for processing a data stream using a virtual machine. In one embodiment, process 500 may be performed by one or more components of network device 230 . In another embodiment, some or all of the blocks of process 500 may be implemented by one or more components of another device in environment 200 (e.g., virtual machine server 240 or central server 250), or by including or excluding network device 230. device group to execute.

As shown in FIG. 5, process 500 may include receiving a service set (block 510). In one implementation, network device 230 may receive a set of services from client device 220 (eg, via a user interface of network device 230 ). For example, client device 220 may be used to develop a set of services and install the set of services on network device 230 . In another implementation, the central server 250 may receive the set of services from the client device 220 . In this case, the central server 250 may provide the set of services to the network device 230 . For example, central server 250 may install the set of services on network device 230 based on a priority policy installed on network device 230 by client device 220 .

Process 500 may also include creating a virtual machine (block 520). In one embodiment, the network device 230 may use a signaling protocol and/or a control plane protocol to instruct the virtual machine server 240 to create a virtual machine according to information associated with the service set. For example, network device 230 may identify a particular virtual machine server 240, and may direct the identified virtual machine server 240 to create a virtual machine with a particular IP address, a particular identifier, a particular configuration, and/or with some other parameters . In some implementations, virtual machine server 240 may provide an indication to network device 230 that a virtual machine has been created. In another embodiment, central server 250 may create virtual machines (eg, in a manner similar to that described above). In this case, central server 250 may broadcast an indication that a virtual machine has been created so that network device 230 may discover the newly created virtual machine.

Process 500 may also include creating a channel with the virtual machine (block 530). For example, network device 230 may use a control plane protocol to create a tunnel between network device 230 and a virtual machine. In some implementations, the channel may allow the network device 230 to provide the data stream to the virtual machine for processing in a manner that prevents the data stream from being routed to the original destination or unintended location of the processed data stream. Furthermore, the channel can facilitate the transmission of data flow when the intermediate router or switch cannot identify the virtual machine. In some implementations, when the network device 230 creates a virtual machine, or when the network device 230 discovers a virtual machine, the network device 230 can automatically create a channel. As a result, a channel can be automatically established when a virtual machine is created so that the channel can be easily used to transmit data streams to the virtual machine.

Process 500 may further include receiving the data stream via the specified interface (block 540). For example, network device 230 may receive data streams from user device 210 via a specific interface (eg, an Ethernet interface, a frame relay interface, a specific port of network device 230 , etc.). As noted above, a particular interface may be associated with a particular group of user devices 210 (eg, a group of user devices 210 subscribed to a service with a network equipment provider).

Process 500 may also include identifying services to provide to the data stream (block 550). For example, network device 230 may identify services to provide to a data flow based on information such as information stored by data structure 400 . In some embodiments, network device 230 may receive a data stream via a particular interface, and may apply a filter to the data stream to determine the service to provide to the data stream (e.g., as described above with respect to FIG. 4 ) . In some implementations, network device 230 may determine processing requirements associated with the identified service.

Process 500 may further include identifying a service processing location (block 560). For example, network device 230 may identify a service processing location (eg, a particular virtual machine implemented by a particular virtual machine server 240 ) based on information such as information stored by data structure 400 . As noted above, a service processing location may be identified based on a virtual machine ID, server ID, IP address, or some other identifier. Alternatively, network device 230 may activate an auto-select function to automatically identify the service processing location. For example, network device 230 may identify virtual machines that provide the identified service, and may select one of those virtual machines that has the processing capacity to meet the processing requirements associated with the identified service. In some implementations, network device 230 may direct virtual machine server 240 to generate a virtual machine in the event that a virtual machine with sufficient processing capacity is not available.

Alternatively, central server 250 may identify the service processing location and provide information identifying the service processing location to network device 230 . For example, central server 250 may identify a virtual machine that provides the identified service and that has processing capacity to meet the processing requirements associated with the identified service. In some implementations, central server 250 may instruct virtual machine server 240 to generate a virtual machine in the event that a virtual machine with sufficient processing capacity is not available.

Process 500 may also include encapsulating the data stream and adding metadata (block 570). For example, network device 230 may add a service set ID (eg, metadata) to a data stream based on information such as information stored by data structure 400 . In some implementations, the network device 230 can append metadata such that the identified virtual machine can identify the service ID and the corresponding service parameters associated with the service ID.

In some implementations, metadata may include contextual information, such as the ID of the interface via which the data stream was received, the ID of the routing instance in which the data stream was received, the subscriber or session ID associated with the data stream, or some Additional contextual information. Additionally, or alternatively, metadata may include scratch pads to identify information to allow a particular virtual machine to communicate information with another virtual machine. Additionally, or alternatively, the metadata may include information to allow the network device to reinsert packets associated with the data flow into the forwarding pipeline as the packets are processed by the virtual machine and received by the network device 230 . In some example implementations, metadata may be 8, 16, or 32 bytes in size, or may be some other size.

In some implementations, network device 230 may encapsulate data streams in channel packets corresponding to channels associated with virtual machine servers 240 (corresponding to service locations). In some implementations, channel packs may facilitate the transmission of data streams via specific channels associated with virtual machine servers 240 .

Process 500 may also include providing the data stream to the service processing location (block 580). For example, network device 230 may provide a data stream to virtual machine server 240 identified in block 560 . In some implementations, network device 230 may provide data streams via channels using channel packets. For example, the channel packet may include information to identify the IP address of the virtual machine server 240 . Network device 230 may look up the IP address in a routing table stored by network device 230 to identify the outbound interface (eg, the interface associated with the tunnel) via which the data flow was transmitted. In some implementations, network device 230 may provide virtual machine server 240 with instructions corresponding to the service ID (eg, instructions instructing virtual machine server 240 on how to process the data flow on behalf of network device 230 ). In some implementations, network device 230 may provide instructions using a service set signaling protocol or some other type of protocol. As an example, assume that network device 230 determines a service set ID "123" associated with a data flow that includes service parameters related to a list of firewall rules. Given these assumptions, virtual machine server 240 may process the data flow on behalf of network device 230 to form a processed data flow with a list of firewall rules applied to the data flow (eg, a data flow with services applied to the data flow).

Process 500 may further include receiving the processed data stream from the service processing location and outputting to the target (block 590). For example, network device 230 may receive a processed data stream from virtual machine server 240 and may output the processed data stream to a target device (eg, a particular user device 210 or service device). As a result, service locations (e.g., specific The virtual machine server 240 implements a specific virtual machine), attaches the service ID to the data flow, and communicates with the virtual machine server 240 to allow the virtual machine server 240 to process the data flow and apply the service according to the service parameter corresponding to the service ID, the network device 230 may provide services to the received data streams.

Although the specific series of blocks for FIG. 5 have been described above, the operations, data flow, and/or order of the blocks may be modified in other implementations. Further, dependent operations and/or data flows may be performed in parallel.

Figure 6A illustrates an example embodiment as described herein. In FIG. 6A , it is assumed that two user devices 210 (eg, UD- 1 and UD- 2 ) communicate with each other via a network device 230 . It is further assumed that, as described above, the network device 230 establishes channels with multiple virtual machines (eg, virtual machines 1 to X, where X>1). In some implementations, network device 230 may receive data streams from UD-1 and/or UD-2 via a network device 230 specific interface. As described above, network device 230 may identify services and service locations associated with a data flow based on the interface via which the data flow is received and/or based on filters.

As described above, network device 230 may identify service locations (eg, virtual machines) to send data streams for processing. For example, network device 230 may perform an automatic selection function to identify a virtual machine that provides the identified service and has the processing capacity to process the identified service. Alternatively, the network device 230 may identify the virtual machine based on virtual machine ID information included in the service set. In FIG. 6A , it is assumed that the network device 230 recognizes the virtual machine 2 as the service location (eg, by automatic selection or by virtual machine ID information included in the service set). Given this assumption, network device 230 may encapsulate the data stream in the channel, append metadata to the data stream (eg, to identify the service set ID), and provide the data stream to virtual machine 2 (eg, via the channel) for processing. In some implementations, the virtual machine 2 can process the data flow on behalf of the network device 230 according to the service set parameter corresponding to the service set ID. As described above, and as shown in FIG. 6A , network devices 230 may receive processed data streams and provide processed data streams to respective user devices 210 .

In some implementations (e.g., when the processed data flow is received from a virtual machine through the network device 230), the processed data flow can be injected into a different routing instance (e.g., a virtual routing and forwarding (VRF) or context or area), rather than the routing instance where the traffic flow is initially received by the network device 230. As a result, data streams may be processed while the virtual machine modifies the destination IP address of packets in the data stream (eg, NAT).

In some implementations, the service location (eg, virtual machine 2 ) may provide the processed data stream to a different network device 230 than the network device 230 from which the data stream was received by the service location. Referring to FIG. 6B, assume that a first network device 230 (eg, network device 230-1) receives a data stream from UD-1 destined for UD-2. Assume further that network device 230-1 identifies virtual machine 2 as a service location. As shown in FIG. 6B, virtual machine 2 may process the data stream and provide the processed data stream to a second network device (eg, network device 230-2). As shown in FIG. 6B, network device 230-2 may provide the processed data stream to a target device (eg, UD-2). In some implementations, the service location may identify the network device 230 to which the processed data stream will be sent based on the network device 230 having the capacity to provide the processed data stream to the target device, based on the network device 230 serving the target device, and/or based on some other factor. to where.

Figure 7 illustrates an example implementation as described herein. FIG. 7 illustrates the linking of virtual machines to process data flow on behalf of the network device 230 . For example, multiple virtual machines (eg, virtual machines 1 through Y (where Y>1)) can be linked together (eg, via a link channel) as a single virtual machine. Similar to FIGS. 6A-6B , network device 230 may identify a service set for a data flow based on an interface via which the data flow is received and/or based on a filter. The network device 230 may append metadata to the data stream, encapsulate the data stream in a channel packet, send the data stream to multiple virtual machines for processing (e.g., via a channel packet), and provide the processed data stream to respective user devices 210 .

Figure 8 illustrates an example implementation as described herein. As noted above, client device 220 may be used to develop applications that virtual machine server 240 may execute to modify the control plane of network device 230 (eg, firewall filters, routing tables, etc.). In some implementations, client device 220 may provide a control plane modification application to virtual machine server 240 . For example, client device 220 may provide the application to central server 250, and central server 250 may provide the application to virtual machine server 240 (e.g., by publishing the application in a form that allows virtual machine server 240 to discover the application and download it from the central server 240). 250 Request to apply). Alternatively, client device 220 may provide applications to virtual machine server 240 independently of central server 250 . In some implementations, the virtual machine server 240 can execute an application and can communicate with the network device 230 to modify the control plane of the network device 230 according to the application's instructions.

Some example applications may allow a virtual machine to install routes in the routing table of network device 230, install firewall filters/policies on network device 230, and associate firewall filters/policies with interfaces on network device 230, from network device 230 to 230 reconfigures and/or enforces operational requirements stored by network device 230 , or allows a virtual machine to perform some other function or modify the control plane of network device 230 in some other way. In some embodiments, a Mobility Management Entity (MME) associated with a cellular network may use a firewall application programming interface (API) to direct a specific flow of MME control traffic to a specific virtual machine where the control plane modification application resides.

Because virtual machine servers 240 may be used to process data flows on behalf of network devices 230, or to modify the control plane of network devices 230, network devices 230 may be able to communicate with one or more virtual machine servers 240 implemented on a common facility or Multiple virtual machines communicate to provide any number of services to any number of streams. Further, virtual machines can be implemented by servers located in various geographic locations. As described above, the virtual machine server 240 may be provided as part of the data center so that the services provided by the virtual machine server 240 may be easily accessed by the network device 230 .

The foregoing description provides illustration and description, but is not intended to be exhaustive or to limit possible implementations to the precise forms disclosed. Modifications and variations are possible in light of the above disclosure or may be acquired from practice of the embodiments.

It will be clear that the different examples of the description provided above may be implemented in various different forms of software, firmware, and hardware in the implementations illustrated in the figures. The actual software code or specific control hardware used to implement these examples is not limiting of the implementations. Accordingly, the operation and behavior of these examples are not described with reference to specific software code - it will be understood that software and controlling hardware can be designed to implement these examples based on the description herein.

Even though certain combinations of features are claimed and/or disclosed in the specification, these combinations are not intended to limit the disclosure of possible embodiments. In fact, many of these features may be combined in various forms, not specifically as claimed and/or disclosed in the specification. Although each dependent claim listed below may directly reference only one other claim, the disclosure of possible implementations includes each dependent claim in combination with every other claim in the claim set.

No element, act, or instruction used in the present application should be construed as critical or essential unless explicitly described as such. Also, as used herein, the article "a" is intended to include one or more items and may be used interchangeably with "one or more". Where only one item is used, the term "one" or similar language is used. Further, the phrase "based on" is intended to mean "based at least in part on," unless expressly stated otherwise.

Claims (1)

1. A method comprising: receiving data streams by network devices; identifying, by the network device, a service to apply to the data flow based on the information about the set of services; providing, by the network device, the data stream to a processing device such that the processing device processes the data stream on behalf of the network device to form a processed data stream, the processing device is distinct from the network device, and said processed data stream includes said data stream with said service applied to said data stream; receiving, by the network device, the processed data stream from the processing device; and The processed data stream is sent by the network device towards a target device.